Where is FTP-Helper?

  • Sorry if this is a obvious question but I have been trying to get my ftp server open for the world (my senior project class) to use. I got PFSense up and running a few hours ago and have been spending several hours trying to get it so my teammates can access my ftp server.

    Firewall - PFSense 2.0
    FTP_Server - Ubuntu vsftp

    What I've done.
    *Read Wiki, Sticky and searched through multpiple threads, googled..
    *Ive tried forwarding port 21, 20
    *Limiting passive ports on vsftpd and forwarding those
    *disabling passive ftp (works but not point and click for windows, which I need it to be)

    What I've been stuck on
    *Virtual CARP IP's ?
    *Where is FTP-Helper, I can't find it under interfaces > WAN or LAN

    Thanks you very much, I and my senior project team greatly appreciate it!

  • for VSFTPD you will need he following:

    pasv_address= <external_ip>pasv_min_port= <start_port>pasv_max_port= <end_port>Once this is set, port forward external_IP (which is either WAN Address or VIP (Carp or other) ) address to the matching internal_IP from start_port to end_port in a separate rule from the port 21 forward. If you are using port forward, then you are also going to have to use manual outbound NAT as well and force the traffic from your internal_IP to use the VIP address. If you are using 1:1 nat, you will not use port forward, but you will have to create the firewall rules.</end_port></start_port></external_ip>

  • Thank you so much for your help, I am not successful yet but I believe I am on the right track. I'll explain what I did and see if you can find any problems in my approach.

    On my ftp server (LAN IP I added


    to my /etc/vsftpd.conf , then restarted vsftpd

    Then on pfsense I

    • Virtual IPs > +
      Address =
      Apply Changes

    *NAT > +
    Destination port = 21
    Redirect target IP =

    *NAT > +
    Destination = ()
    Destination port = 100-110
    Redirect target IP =
    Apply Changes

    *NAT > Outbound
    Mode = Manual

    *NAT > Outbound > +
    Source - Address =
    Apply Changes

    I know I did something wrong, I bet somewhere near the bottom of my steps but VIP's are all very new to me =
    I bet I messed up by picking a random outgoing VIP (it would complain if I used my real WAN), also my WAN is dynamic and changes every few months. I probably also messed up when creating the outgoing NAT, as it changes the Source-Address from to

    Anyway thanks for your help, hopefully I can be up and running as soon as possible so my project mates don't give up on me…

  • on the outbound NAT, you have to use the instead of the WAN address. static port can be used, but should not matter.

  • Thanks for your help, I might test this and report back i the future.

    For now I have everything going well using ownCloud. It's less steps for my group to remember as well.

  • Thanks for this, I found how to have a working configuration on pfSense for my FTP server (on pfSense 2.0.1).

    First, I still don't know or understand where the FTP-helper is located. Everywhere in the documentation, wiki, tutorials, the FTP-helper is mentioned under Interfaces>WAN, but I could never see it, and it doesn't appear at all in the web interface. I actually lost hours looking for this damn FTP-helper, and I don't know if it still exists in pfSense 2.0. But I guess I got it working without it anyway.

    Let's say my ftp server is on on port 21, using port 20 for ftp-data and ports 5000:5100 as the passive range.
    It's Filezilla Server, and I configured it to return the public IP addresse which let's say is something like

    First what I did on pfSense was :
    NAT inbound
    Port forward 20:21 to, ports 20:21
    Port forward 5000:5100 to, ports 5000:5100

    with the corresponding firewall rules.

    It worked, but not for everybody. Someone couldn't actually connect to the FTP, either in active or passive mode. It worked with the previous firewall we used, but only in active mode.

    It looks like this guy was working in a place where a firewall was set up, blocking any traffic originating from port>1024 (I guess to block P2P, etc).

    I dumped the packets here on both sides on pfSense (LAN & WAN) and I saw that everything originating from was mapped to, because the TCP session originated from the FTP client on But everything that came back from was mapped to a random port on, and so was blocked by the remote firewall.

    Thanks to this thread, I switched the NAT outbound rule generation to manual and added two rules, one to configure as a static port and one to map 5000:5100 as static ports too, both rules before the default ones, and it looks to work fine now, for everyone.

Log in to reply